Install was made follwing the documentation.
No INPUTs configured and no exctrators used.
The pipelines i use is only to drop useless messages like ports up/down and PoE messages.
I configured two streams one for syslog messages from aruba switchs and other for cisco switchs, only to separate the syslog messages by manufacturer.
Inputs are required to receive the information the Cisco switches are sending you. The Input should generally match the type of data sent (i.e. Syslog, GELF, etc) … the port number should match as well…
Thank you all.
I found the source of the problem.
This only happens with older switches (cisco 2950, 2900XL, 3500XL, etc).
If you enable service sequence-numbers the switch inserts two sequence numbers instead of just one. if you disable the command service sequence-numbers (no service sequence-numbers) the problem disappears.